Privacy Policy

1. Who is responsible for your information

The responsible party is [to be confirmed: registered company name], registration number [to be confirmed: company registration number], trading as Biometrica at biometrica.me, of [to be confirmed: registered address].

Our Information Officer is [to be confirmed: Information Officer]. Anything about your personal information — a request, a correction, a complaint — reaches them at [to be confirmed: email address for data requests] or through the contact form.

2. What we collect

Only what the product needs to work. In practice that is:

• Your account — your name, email address, a profile photo if you upload one, password (stored only as a hash), and, if you sign in with Google or GitHub instead, the account link they give us. You can also sign in by a one-time link we email you, with no password at all. We also keep failed sign-in counts so we can lock an account that is under attack.
• Your profile — optionally your full name, sex, date of birth and unit preference, because reference ranges differ by age and sex. You can also add your South African ID number, which we hold encrypted; it is its own field, and you can remove it at any time. The app only ever shows its last four digits — but a requisition you generate prints it in full, because the laboratory needs it to identify you.
• Your lab reports — the PDF or image you upload, and everything read out of it: each biomarker, its value and unit, the date of the test, the lab's name, and the lines we could not match to a known biomarker.
• What we derive from them — your biomarker history and trends, the insights and action plans the assistant generates, and any readings you enter by hand.
• Strava, if you connect it — your activities (type, name, date, distance, time, elevation, speed, average and maximum heart rate, calories) and your athlete profile weight. Heart rate and weight become biomarker readings alongside your bloods. Your access and refresh tokens are encrypted; we never see your Strava password.
• Payment references — your plan, its state, and the references PayFast gives us. We never see, receive or store your card details — the card is entered on PayFast's own payment page (see section 6).
• A record of what happened — an audit log of sign-ins, changes and deletions, holding your user id, the action, the resource id and — for sign-in events — the source IP address. It holds ids, never the content of your results.
• Your sessions — for each device you are signed in on, the IP address and the browser's user-agent string, so that you can see your active sessions and end any you do not recognise.
• Notifications and devices — in-app notifications, and, if you enable push, the browser push address for that device.

Who else can see it. Your information belongs to your account, not to you personally. On an individual account that is the same thing and nobody else can see anything. On a shared account it is not: everyone on it can see everything on it — the results, the history, the insights, and the profile details including the masked ID number. That is the point of a shared account for a household tracking together, and it is also the reason a shared account is not the way to keep your results to yourself. If you want them private, use an account of your own.

We use no analytics, no advertising and no cross-site trackers, and there is nothing to consent to on arrival. What we store in your browser is listed in the cookie policy.

3. Why we process it, and on what basis

Your health information is processed on your consent, given when you create an account and upload a result, as POPIA requires for special personal information. That consent covers storing it in the European Union (section 7). You can withdraw it — see section 9.

The rest is processed because it is necessary to provide the service you asked for (running your account, taking payment, sending you the emails the product owes you) or because we have a legitimate interest in keeping the service secure and working: the audit log, the sign-in lockout, and error reports.

4. What we do not do

We do not sell your information, we do not hand it to data brokers, we do not use it for advertising, and we do not use your results to profile you for anything other than showing them back to you.

5. The AI assistant

The assistant runs on Amy, our own AI service. Three things reach it: the pages of a lab report, so it can read the numbers off them; your confirmed biomarker values, when it writes insights; and your question, when you ask one — after which it reads your results itself through a set of handles that let it read your results and propose insights and plans for you to accept or discard. Every use of them is logged.

We identify you to it by a meaningless account id — never your name, your email address or your ID number. Two things are the exception. We send the report page as an image so it can be read, so whatever your laboratory printed on it — usually your name — goes with it. And the text we send carries the names things already had: the filename of the report you uploaded, and the titles of any Strava activities you connected. Renaming a file before you upload it keeps your name out of that one. Amy passes the work on to a large language model provider — [to be confirmed: the model provider and its retention terms]. Biometrica can be run with its AI switched off entirely, and no health data leaves us while it is — but that switch is ours, not a setting on your account. Tell us if you want your information kept away from it and we will stop sending it.

Deleting something in Biometrica removes it from Biometrica's live service; our own backup copies expire as section 8 says. Copies held by the AI service are removed separately, by asking us — there is no button that does it for you yet, and we would rather say so than imply otherwise.

The assistant's answers are information, not medical advice. Biometrica organizes and explains your lab results. It is not a medical device and does not diagnose or treat any condition — always talk to a qualified clinician about your health decisions.

6. Who else processes your information

These are our operators. Each gets only what its job needs, and none of them may use your information for their own purposes.

• Railway — hosts the application and the database.
• Cloudflare R2 — stores the lab report files themselves, under a key prefix unique to your account.
• Amy — the AI service described in section 5, operated by the same company.
• Resend — delivers our transactional email.
• Sentry — receives error reports when something breaks. Your email address, username and IP address are removed before anything is sent.

These are services you choose to use. Each receives information only when you use it, and handles it under its own terms and privacy policy rather than ours.

• PayFast — takes the payment, only if you pay for a plan. You enter your card on PayFast's page, not ours; we receive a payment reference back and nothing else.
• Strava — only if you connect it, and only ever to read from. We send Strava no health or biomarker data.
• Google or GitHub — only if you choose to sign in with them.
• Your browser's push service (Google, Mozilla or Apple) — only if you turn on push notifications.

7. Where your information is stored

The application and its database run on Railway in the European Union, and lab report files are stored in Cloudflare R2 in its EU jurisdiction. PayFast processes payments in South Africa. Holding your information in the European Union means it leaves South Africa, and so does what reaches the other services in section 6 that are outside South Africa. That is a transfer across the border under section 72 of POPIA, and each one rests on one of these:

• A contract. Railway, Cloudflare, Resend and Sentry are bound by their data-processing terms to protect your information and to use it only for the work we give them.
• Your choice. Strava, Google or GitHub, and your browser's push service receive anything only when you choose to connect Strava, sign in with Google or GitHub, or turn on push notifications, and they handle it under their own terms (section 6).
• Our own service. Amy, the AI service in section 5, is operated by the same company, under this policy.
• The AI model provider (section 5): [to be confirmed: the model provider's cross-border safeguard].

If the GDPR or the UK GDPR covers you: Resend and Sentry receive your information under the EU–US Data Privacy Framework or the standard contractual clauses in their data-processing terms, and Railway's and Cloudflare's terms carry the same clauses for anything they handle outside the EU. For UK users, each of those terms adds the UK's own transfer addendum. The services you choose yourself, and the AI model provider, are as set out above.

8. How long we keep it

• Your results and everything derived from them are kept until you delete them. Nothing expires them on a timer, and cancelling a paid plan does not delete anything.
• Notifications are deleted after 90 days.
• Audit records are kept for 12 months and then deleted automatically. They survive your account's deletion for the remainder of that window, holding your user id but no name, email or health data — that is what lets us show, if it is ever questioned, that an erasure actually happened.
• Files with no record attached (an upload that was never completed) are swept from storage by a daily job, once they are more than a day old.
• Operational logs and error reports are kept for up to 90 days, then deleted.
• Backups. What you delete leaves the live service at once, but our database backups, and the point-in-time recovery archive that can rebuild the database as it stood at any moment in its window, still hold a copy until they expire on their own, within [to be confirmed: how long our backups and recovery archive are kept]. We restore the database only to recover the service, and if we ever do, we delete again everything that was deleted after the moment we restored to. Our file storage keeps no backups or earlier versions of your files; an organization that keeps its files in its own storage sets that storage's own rules.

9. Your rights, and how to use them

POPIA gives you these, and the product implements them:

• Know and access — you can see what is held about you in the app, and export the account's records. An account administrator runs it from Members → Export organization data; we assemble a zip of the account's data as readable JSON and notify you when the download is ready. Two things are not in that zip: the original report files you uploaded, and your sign-in details — and your ID number appears in it masked to its last four digits. Ask us for any of those and we will send them to you. On an individual account that administrator is you; on a shared one, ask yours, or ask us.
• Correct — edit your profile freely, and fix anything the app misread while you are confirming a report. Once confirmed, readings that came from a laboratory report or from Strava belong to their source and are not editable in the app; ask us and we will correct them.
• Delete — delete a reading you entered yourself from where it appears, and discard an insight or an action plan that is waiting for your decision. Anything already in your record — which is most of it, because insights you generate yourself are kept as soon as they are made — has no delete button; ask us and we will remove it. New chat ends the current conversation and clears it from Biometrica, which keeps no chat messages of its own; copies held by the AI service are removed by asking us (section 5).
• Delete your account — from Account → Delete account. If you are the only administrator of an organization that still has other members, the app refuses until you hand that role to someone else or remove them. Otherwise an organization in which you are the only member is deleted outright — its results, files, profile, integrations and subscription go with it — while an organization you merely belong to is left standing, and you are removed from it — what is on that organization, including any profile details and results you added there, stays with it. Deletion cannot be undone, so export first if you want a copy; backup copies expire on their own (section 8). Deleting needs your password, so if you signed up with Google or GitHub and have never set one, set a password first from Forgot password? on the sign-in page, or contact us and we will delete the account for you.
• Object, and withdraw consent — disconnect Strava to stop reading from it, stop uploading results, or tell us to stop processing your information and we will stop and delete the account. Withdrawing consent to the AI is a request to us (section 5), not a switch on your account.
• Complain — to us first, and to the Regulator if we do not put it right (section 11).

We answer requests within one month, extendable by two further months for a complex request, and we tell you within the first month if we need to. We will ask you to confirm who you are before we act on one, so that nobody can use these rights against you.

10. How we protect it

Everything that crosses the public internet travels over TLS. Each account's data is isolated from every other at the database level by row-level security, not by application code remembering to filter. Your ID number and your Strava tokens are encrypted with AES-256-GCM. Sign-in sessions use a cookie your browser will not hand to another site or expose to JavaScript, and access tokens live at most fifteen minutes. Uploaded files are reached only through short-lived signed links.

No system is perfect. If a breach ever affects your personal information we will notify you and the Information Regulator, as POPIA requires.

11. Complaints

Tell us first — we would rather fix it. If you are not satisfied, you can complain to the Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · 010 023 5200 · toll free 0800 017 160 · enquiries@inforegulator.org.za. POPIA complaints are lodged through the Regulator's eServices portal at inforegulator.org.za.

If the GDPR or the UK GDPR covers you, you can also complain to your own data-protection authority — section 14.

12. Children

Biometrica is for adults. You must be 18 or older to create an account, and we do not knowingly process the information of anyone younger. If you believe a child has an account, tell us and we will delete it.

13. Changes

If this policy changes we update the date at the top and, where the change matters to you, tell you in the app before it takes effect. The version that applies to you is the one published when you used the service.

14. If you are in the European Union or the United Kingdom

When you use Biometrica from the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) — in the UK, the UK GDPR — applies alongside POPIA. Everything above still holds; this section adds what those laws require.

• Our legal bases — the three in section 3. Your health information is processed on your explicit consent (GDPR Art. 9(2)(a)). Running your account, taking payment and sending the emails the product owes you are necessary for our contract with you (Art. 6(1)(b)). The audit log, the sign-in lockout and error reports rest on our legitimate interest in keeping the service secure (Art. 6(1)(f)).
• Data portability — you can have the information you gave us in a structured, machine-readable form. The export in section 9 is that form; ask us for anything it leaves out, or if you are not your account's administrator.
• Restriction — you can ask us to restrict how we use your information while a correction or an objection is being settled. We then keep it and do nothing else with it.
• Objection — you can object to what we do on our legitimate interest. We stop unless we can show compelling grounds that override your interests, or need it to establish or defend a legal claim.
• Complaints — besides the Information Regulator (section 11), you can complain to the data-protection authority of the EU or EEA country where you live or work, or where you think the breach happened; in the UK, to the Information Commissioner's Office (ico.org.uk).
• Our representatives — we are not established in the EU or the UK, so we have representatives there you can write to about anything in this policy. Our EU representative is [to be confirmed: our EU representative and their address]. Our UK representative is [to be confirmed: our UK representative and their address].